CVE-2017-11480.json

{
  "schema_version": "1.6.3",
  "id": "CVE-2017-11480",
  "modified": "2024-05-20T16:03:47Z",
  "published": "2022-02-15T01:57:18Z",
  "aliases": [
    "GHSA-9q3g-m353-cp4p",
    "GO-2022-0643"
  ],
  "related": [],
  "summary": "Denial of service in github.com/elastic/beats. Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic. Las versiones anteriores a la 5.6.4 de Packetbeat se han visto afectadas por un fallo de denegación de servicio en el manipulador del protocolo PostgreSQL. Si Packetbeat está escuchando el tráfico PostgreSQL y un usuario es capaz de enviar tráfico de la red arbitrario al puerto monitorizado, el atacante podría evitar que Packetbeat registre correctamente otro tráfico PostgreSQL",
  "details": "A local attacker can cause a panic if they are able to send arbitrary traffic to a monitored port, due to an out of bounds read",
  "severity": [
    {
      "type": "CVSS_V2",
      "score": "5.0"
    },
    {
      "type": "CVSS_V3",
      "score": "7.5"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/elastic/beats"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.0+incompatible"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/elastic/beats/packetbeat/protos/pgsql",
            "symbols": [
              "pgsqlFieldsParser",
              "pgsqlPlugin.Parse"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/elastic/beats/pull/5457"
    },
    {
      "type": "FIX",
      "url": "https://github.com/elastic/beats/commit/aeca65779d573976981587ca1d1461399e1b59dd"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/beats-5-6-4-security-update/106739"
    }
  ],
  "credits": [],
  "database_specific": {
    "metrics": {
      "cvssMetricV30": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "3.0",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      ],
      "cvssMetricV2": [
        {
          "source": "nvd@nist.gov",
          "type": "Primary",
          "cvssData": {
            "version": "2.0",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "accessVector": "NETWORK",
            "accessComplexity": "LOW",
            "authentication": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0
          },
          "baseSeverity": "MEDIUM",
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "acInsufInfo": false,
          "obtainAllPrivilege": false,
          "obtainUserPrivilege": false,
          "obtainOtherPrivilege": false,
          "userInteractionRequired": false
        }
      ]
    },
    "cwe_details": [
      {
        "cwe_id": "NVD-CWE-noinfo",
        "name": "Primary",
        "description": "",
        "source": "nvd@nist.gov",
        "url": ""
      },
      {
        "cwe_id": "CWE-404",
        "name": "Secondary",
        "description": "",
        "source": "bressers@elastic.co",
        "url": ""
      }
    ],
    "repositories": [
      {
        "url": "https://github.com/elastic/beats",
        "name": "elastic/beats",
        "description": ":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ",
        "date_created": "2014-02-05T19:01:02Z",
        "date_last_push": "2024-06-24T07:51:34Z",
        "owner": "elastic",
        "forks_count": "4885",
        "stars_count": "12041",
        "repo_language": "Go"
      }
    ],
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "126517DF-98B0-4115-897D-3424BB9850A0",
            "versionEndExcluding": "5.6.4"
          }
        ]
      }
    ],
    "vulndb_data": {
      "url": "https://pkg.go.dev/vuln/GO-2022-0643",
      "review_status": "REVIEWED"
    },
    "datasources": {
      "govuln": true,
      "nvd": true,
      "cvefixes": false
    }
  }
}